SkillGuard: SSL for Agent Skills

Feature Extraction (35 signals)

Each skill is reduced to 35 numbers: shell exec count, network calls, obfuscation score, reverse shell patterns, credential access, author reputation, download counts, byte entropy, code density ratios, and more. Code blocks inside SKILL.md files are extracted and scanned even when no separate scripts exist. Each value is scaled to 0–128.

Neural Network (4,460 params)

Three layers of neurons (35→56→40→4) mix the features into progressively higher-level patterns. Layer 1 detects basic combinations ("obfuscation + shell exec"). Layer 2 builds compound indicators ("credential stealer" vs "API client"). Layer 3 outputs four scores: SAFE, CAUTION, DANGEROUS, MALICIOUS. Highest wins.

Confidence & Decisions

Raw scores are converted to probabilities via softmax (T=12.8). If the distribution is spread out (high entropy), the model flags it for human review. DANGEROUS/MALICIOUS results need ≥50% confidence for DENY; otherwise they're flagged. SAFE/CAUTION results get ALLOW unless entropy is too high.

Integer Arithmetic & ZK Proofs

All math uses integers (scale=128) instead of floating-point, because the entire forward pass runs inside a zero-knowledge SNARK (Jolt Atlas). This produces a ~53 KB cryptographic proof that the classification was computed correctly. Anyone can verify the proof without trusting SkillGuard or seeing the model weights.